CVEs published December 21, 2024
30 CVEs were published on December 21, 2024: 1 critical, 4 high.
- Published
- 30
- Critical
- 1
- High
- 4
- Medium
- 25
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- averta Shortcodes and extra features for Phlox theme
- 2
- IBM i
- 2
- motovnet Ebook Store
- 2
- code-projects Job Recruitment
- 1
- Codezips E-Commerce Website
- 1
- elemntor Elementor Website Builder – more than just a page…
- 1
- Emlog Pro
- 1
- fahadmahmood WP Docs
- 1
- GTPayment Donations
- 1
- implecode eCommerce Product Catalog Plugin for WordPress
- 1
Critical 1
High 4
- CVE-2024-12721Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injectionwebbuilder143 Custom Product tabs for WooCommerce
- CVE-2024-12771eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Resetimplecode eCommerce Product Catalog Plugin for WordPress
- CVE-2024-12066SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletionsmsaexpress SMSA Shipping
- CVE-2024-11977kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Executionproperfraction kk Star Ratings – Rate Post & Collect User F…
Medium, low and unrated 25
- CVE-2024-12884Codezips E-Commerce Website login.php sql injectionCodezips E-Commerce Website
- CVE-2024-51463IBM i server-side request forgeryIBM i
- CVE-2024-51464IBM i authentication bypassIBM i
- CVE-2024-12883code-projects Job Recruitment _email.php cross site scriptingcode-projects Job Recruitment
- CVE-2024-12875Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Downloadsmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-12591MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcodewbolt MagicPost – WordPress文章管理功能增强插件
- CVE-2024-10453Elementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settingselemntor Elementor Website Builder – more than just a page…
- CVE-2024-11688LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scriptingvan-abel LaTeX2HTML
- CVE-2024-11722Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injectionshabti Frontend Admin by DynamiApps
- CVE-2024-12408WP on AWS <= 5.2.1 - Reflected Cross-Site Scriptingwpseahorse WP on AWS
- CVE-2024-12558WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_dbpuckrobin WP BASE Booking of Appointments, Services and Eve…
- CVE-2024-10797Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosuresolitweb Full Screen Menu for Elementor
- CVE-2024-11808Pingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site ScriptingPingmeter Uptime Monitoring
- CVE-2024-12588Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widgetaverta Shortcodes and extra features for Phlox theme
- CVE-2024-9545Shortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodesaverta Shortcodes and extra features for Phlox theme
- CVE-2024-11975Reactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site ScriptingReactflow Visitor Recording and Heatmaps
- CVE-2024-11682G Web Pro Store Locator <= 2.1 - Reflected Cross-Site Scriptingmoonheart G Web Pro Store Locator
- CVE-2024-11196Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcodetugbucket Multi-column Tag Map
- CVE-2024-12697real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrealmaster-1 real.Kit
- CVE-2024-12262Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'motovnet Ebook Store
- CVE-2024-12635WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'fahadmahmood WP Docs
- CVE-2024-11938One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcodewpswings One Click Upsell Funnel for Woocommerce
- CVE-2024-11287Ebook Store <= 5.8001 - Reflected Cross-Site Scriptingmotovnet Ebook Store
- CVE-2024-11607GTPayment Donations <= 1.0.0 - Stored XSS via CSRFGTPayment Donations
- CVE-2024-12846Emlog Pro link.php cross site scriptingEmlog Pro